---
fixtures:
  - SecureRBACPolicyFixture

vars:
  - &project_id $ENVIRON['PROJECT_ID']
  - &admin_project_id $ENVIRON['ADMIN_PROJECT_ID']
  - &service_project_id $ENVIRON['SERVICE_PROJECT_ID']
  - &admin_headers
    x-auth-token: user
    x-roles: admin
    x-project-id: admin_project_id
    accept: application/json
    content-type: application/json
    openstack-api-version: placement latest
  - &service_headers
    x-auth-token: user
    x-roles: service
    x-project-id: service_project_id
    accept: application/json
    content-type: application/json
    openstack-api-version: placement latest
  - &system_admin_headers
    x-auth-token: user
    x-roles: admin,member,reader
    accept: application/json
    content-type: application/json
    openstack-api-version: placement latest
    openstack-system-scope: all
  - &system_reader_headers
    x-auth-token: user
    x-roles: reader
    accept: application/json
    content-type: application/json
    openstack-api-version: placement latest
    openstack-system-scope: all
  - &project_admin_headers
    x-auth-token: user
    x-roles: admin,member,reader
    x-project-id: *project_id
    accept: application/json
    content-type: application/json
    openstack-api-version: placement latest
  - &project_member_headers
    x-auth-token: user
    x-roles: member,reader
    x-project-id: *project_id
    accept: application/json
    content-type: application/json
    openstack-api-version: placement latest
  - &project_reader_headers
    x-auth-token: user
    x-roles: reader
    x-project-id: *project_id
    accept: application/json
    content-type: application/json
    openstack-api-version: placement latest

tests:

- name: project admin can list resource classes
  GET: /resource_classes
  request_headers: *project_admin_headers
  response_json_paths:
    $.resource_classes.`len`: 21  #  Number of standard resource classes

- name: project member cannot list resource classes
  GET: /resource_classes
  request_headers: *project_member_headers
  status: 403

- name: project reader cannot list resource classes
  GET: /resource_classes
  request_headers: *project_reader_headers
  status: 403

- name: system reader cannot list resource classes
  GET: /resource_classes
  request_headers: *system_reader_headers
  status: 403

- name: system admin cannot list resource classes
  GET: /resource_classes
  request_headers: *system_admin_headers
  status: 403

- name: admin can list resource classes
  GET: /resource_classes
  request_headers: *admin_headers
  response_json_paths:
    $.resource_classes.`len`: 21  #  Number of standard resource classes

- name: service can list resource classes
  GET: /resource_classes
  request_headers: *service_headers
  response_json_paths:
    $.resource_classes.`len`: 21  #  Number of standard resource classes

- name: admin can create resource classes
  POST: /resource_classes
  request_headers: *admin_headers
  data:
    name: CUSTOM_RES_CLASS_POLICY
  status: 201
  response_headers:
    location: //resource_classes/CUSTOM_RES_CLASS_POLICY/

- name: service can create resource classes
  POST: /resource_classes
  request_headers: *service_headers
  data:
    name: CUSTOM_RES_CLASS_POLICY1
  status: 201
  response_headers:
    location: //resource_classes/CUSTOM_RES_CLASS_POLICY1/

- name: project admin can create resource classes
  POST: /resource_classes
  request_headers: *project_admin_headers
  data:
    name: CUSTOM_RES_CLASS_POLICY2
  status: 201
  response_headers:
    location: //resource_classes/CUSTOM_RES_CLASS_POLICY2/

- name: project member cannot create resource classes
  POST: /resource_classes
  request_headers: *project_member_headers
  data:
    name: CUSTOM_RES_CLASS_POLICY
  status: 403

- name: project reader cannot create resource classes
  POST: /resource_classes
  request_headers: *project_reader_headers
  data:
    name: CUSTOM_RES_CLASS_POLICY
  status: 403

- name: system reader cannot create resource classes
  POST: /resource_classes
  request_headers: *system_reader_headers
  data:
    name: CUSTOM_RES_CLASS_POLICY
  status: 403

- name: system admin cannot create resource classes
  POST: /resource_classes
  request_headers: *system_admin_headers
  data:
    name: CUSTOM_RES_CLASS_POLICY
  status: 403

- name: project admin can show resource class
  GET: /resource_classes/CUSTOM_RES_CLASS_POLICY
  request_headers: *project_admin_headers
  response_json_paths:
    $.name: CUSTOM_RES_CLASS_POLICY

- name: project member cannot show resource class
  GET: /resource_classes/CUSTOM_RES_CLASS_POLICY
  request_headers: *project_member_headers
  status: 403

- name: project reader cannot show resource class
  GET: /resource_classes/CUSTOM_RES_CLASS_POLICY
  request_headers: *project_reader_headers
  status: 403

- name: system reader cannot show resource class
  GET: /resource_classes/CUSTOM_RES_CLASS_POLICY
  request_headers: *system_reader_headers
  status: 403

- name: system admin cannot show resource class
  GET: /resource_classes/CUSTOM_RES_CLASS_POLICY
  request_headers: *system_admin_headers
  status: 403

- name: admin can show resource class
  GET: /resource_classes/CUSTOM_RES_CLASS_POLICY
  request_headers: *admin_headers
  response_json_paths:
    $.name: CUSTOM_RES_CLASS_POLICY

- name: service can show resource class
  GET: /resource_classes/CUSTOM_RES_CLASS_POLICY
  request_headers: *service_headers
  response_json_paths:
    $.name: CUSTOM_RES_CLASS_POLICY

- name: project admin can update resource class
  PUT: /resource_classes/CUSTOM_NEW_CLASS_POLICY2
  request_headers: *project_admin_headers
  status: 201

- name: admin can update resource class
  PUT: /resource_classes/CUSTOM_NEW_CLASS_POLICY
  request_headers: *admin_headers
  status: 201

- name: service can update resource class
  PUT: /resource_classes/CUSTOM_NEW_CLASS_POLICY1
  request_headers: *service_headers
  status: 201

- name: project member cannot update resource class
  PUT: /resource_classes/CUSTOM_NEW_CLASS_POLICY
  request_headers: *project_member_headers
  status: 403

- name: project reader cannot update resource class
  PUT: /resource_classes/CUSTOM_NEW_CLASS_POLICY
  request_headers: *project_reader_headers
  status: 403

- name: system reader cannot update resource class
  PUT: /resource_classes/CUSTOM_NEW_CLASS_POLICY
  request_headers: *system_reader_headers
  status: 403

- name: system admin cannot update resource class
  PUT: /resource_classes/CUSTOM_NEW_CLASS_POLICY
  request_headers: *system_admin_headers
  status: 403

- name: project admin can delete resource class
  DELETE: /resource_classes/CUSTOM_NEW_CLASS_POLICY2
  request_headers: *project_admin_headers
  status: 204

- name: project member cannot delete resource class
  DELETE: /resource_classes/CUSTOM_NEW_CLASS_POLICY
  request_headers: *project_member_headers
  status: 403

- name: project reader cannot delete resource class
  DELETE: /resource_classes/CUSTOM_NEW_CLASS_POLICY
  request_headers: *project_reader_headers
  status: 403

- name: system reader cannot delete resource class
  DELETE: /resource_classes/CUSTOM_NEW_CLASS_POLICY
  request_headers: *system_reader_headers
  status: 403

- name: system admin cannot delete resource class
  DELETE: /resource_classes/CUSTOM_NEW_CLASS_POLICY
  request_headers: *system_admin_headers
  status: 403

- name: admin can delete resource class
  DELETE: /resource_classes/CUSTOM_NEW_CLASS_POLICY
  request_headers: *admin_headers
  status: 204

- name: service can delete resource class
  DELETE: /resource_classes/CUSTOM_NEW_CLASS_POLICY1
  request_headers: *service_headers
  status: 204
